search

pdsinterop / php-solid-server

Standalone Solid Server written in PHP by PDS Interop
https://pdsinterop.org/php-solid-server/
MIT License
46 stars 7 forks source link

Mismatch HTA and PATH in DPoP when using AddSlashToPathController #55

Open Potherca opened 2 years ago

Potherca commented 2 years ago

There is an issue with the AddSlashToPathController that causes problems with the DPop class from pdsinterop/solid-auth.

Because of the added slash, the requested HTU and PATH no longer match.

To see this in action, compare a read/write from https://localhost/storage (without trailing slash):

127.0.0.1 - - [26/Nov/2021:12:49:25 +0000] "OPTIONS /storage HTTP/1.1" 200 1282 "http://localhost:8000/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0"
127.0.0.1 - - [26/Nov/2021:12:49:25 +0000] "GET /storage HTTP/1.1" 302 782 "http://localhost:8000/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0"
127.0.0.1 - - [26/Nov/2021:12:49:25 +0000] "OPTIONS /storage/ HTTP/1.1" 200 770 "http://localhost:8000/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0"
[Fri Nov 26 12:49:25.748410 2021] 11, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.748424 2021]  1, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.749233 2021]  2, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.749244 2021]  3, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.749247 2021]  4, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.749249 2021]  5, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.750628 2021]  6, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.750637 2021]  7, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.750648 2021]  REQUESTED HTU https://localhost/storage, referer: http://localhost:8000/
[Fri Nov 26 12:49:25.750651 2021]  REQUESTED PATH https://localhost/storage/, referer: http://localhost:8000/

to that of https://localhost/storage/ (with trailing slash):

127.0.0.1 - - [26/Nov/2021:12:49:33 +0000] "OPTIONS /storage/ HTTP/1.1" 200 1282 "http://localhost:8000/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0"
[Fri Nov 26 12:49:33.461758 2021] 11, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.461771 2021]  1, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.462644 2021]  2, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.462655 2021]  3, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.462659 2021]  4, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.462663 2021]  5, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464054 2021]  6, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464064 2021]  7, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464074 2021]  REQUESTED HTU https://localhost/storage/, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464077 2021]  REQUESTED PATH https://localhost/storage/, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464079 2021]  8, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464244 2021]  9, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464258 2021]  22, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464291 2021] stdClass Object\n(\n    [crv] => P-256\n    [kty] => EC\n    [x] => 18V3wQu0_i3bFcU_2oxplv3OvTIOlT651ClS___-jn4\n    [y] => G4RdqmKAZL7r4Ar8DjFVm7KMdRuk0R4xBnCFqN942Q4\n    [alg] => ES256\n)\n, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464436 2021] stdClass Object\n(\n    [jkt] => BqowyaBeAs6YO5iYaO-K5xz4rJy2Ga31OHOY8M8puKA\n)\n, referer: http://localhost:8000/
[Fri Nov 26 12:49:33.464441 2021] dpopKey, referer: http://localhost:8000/

Currently I am not entirely sure if we should fix this here or in the auth package... :thinking: